Accounting

These scenarios show accounting feature when secure mode is enabled. All logs are stored in file: running://log/user/audit_file/audit_file

File Logs

Description

Show different logs stored in audit file

Scenario

Step 1: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Secure mode started
Show output
2026-03-20 13:33:52.497403 daemon-info , modulelauncher[609809]:  Secure mode started
2026-03-20 13:33:53.865083 auth-notice , OSDxCLI:  User 'admin' has logged in.

Step 2: Run command show running at DUT0 and expect this output:

Show output
# Teldat OSDx VM version v4.2.8.5
# Fri 20 Mar 2026 13:33:54 +00:00
# Warning: Configuration has not been saved
set system login user admin authentication encrypted-password '$6$Bb8SRGAVovRo3cV2$cx1CkkM7fh98BPzPAEASrB6LMGta14wl9vnry5v.F8NK8wUAfLgnh5ATDGibEMD2ZZzONqWiK/ZTk80n/SoVJ.'
set system security medium

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' executed a new command: 'show running'
Show output
2026-03-20 13:33:52.497403 daemon-info , modulelauncher[609809]:  Secure mode started
2026-03-20 13:33:53.865083 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-03-20 13:33:54.006741 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-03-20 13:33:54.043635 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.

Step 4: Set the following configuration in DUT0 :

set system cli configuration logging cli info
set system login user admin authentication encrypted-password '$6$Bb8SRGAVovRo3cV2$cx1CkkM7fh98BPzPAEASrB6LMGta14wl9vnry5v.F8NK8wUAfLgnh5ATDGibEMD2ZZzONqWiK/ZTk80n/SoVJ.'
set system security medium

Step 5: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' committed the configuration
Show output
2026-03-20 13:33:52.497403 daemon-info , modulelauncher[609809]:  Secure mode started
2026-03-20 13:33:53.865083 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-03-20 13:33:54.006741 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-03-20 13:33:54.043635 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'show running'.
2026-03-20 13:33:54.228131 auth-notice , OSDxCLI:  User 'admin' executed a new command: 'file show running://log/user/audit_file/audit_file'.
2026-03-20 13:33:54.341084 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2026-03-20 13:33:54.398313 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system cli configuration logging cli info'.
2026-03-20 13:33:54.502730 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2026-03-20 13:33:54.560274 user-warning , OSDxCLI:  Signal 10 received
2026-03-20 13:33:54.562966 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2026-03-20 13:33:54.617423 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Hidden Passwords

Description

Plain passwords are not displayed

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set system aaa server tacacs TAC1 address 10.215.168.1
set system aaa server tacacs TAC1 encrypted-key U2FsdGVkX185ly5QlJG1OzXpN8u51GS//FNipw/H9WU=
set system login user admin authentication encrypted-password '$6$Psd2Z4Ib9.Foz.6R$8V6PMzfJqKKAWfaggU0Oi5PfJJFnqLNkGW3muEPIW/oThlk0eQI7vCmLAXnS8bcyhjIps8t5JB7hABYjxTGbO/'
set system security medium

Step 2: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'
Show output
2026-03-20 13:34:02.293264 daemon-info , modulelauncher[610221]:  Secure mode started
2026-03-20 13:34:03.866968 auth-notice , OSDxCLI:  User 'admin' has logged in.
2026-03-20 13:34:04.022105 auth-notice , OSDxCLI:  User 'admin' entered the configuration menu.
2026-03-20 13:34:04.152126 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
2026-03-20 13:34:04.255124 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 key ******'.
2026-03-20 13:34:04.360150 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'set system aaa server tacacs TAC1 address 10.215.168.1'.
2026-03-20 13:34:04.457150 auth-notice , OSDxCLI:  User 'admin' added a new cfg line: 'show working'.
2026-03-20 13:34:04.722723 auth-notice , OSDxCLI:  User 'admin' committed the configuration.
2026-03-20 13:34:04.741378 auth-notice , OSDxCLI:  User 'admin' left the configuration menu.

Audit file permissions

Description

Non admin user is allowed to open audit file

Scenario

Step 1: Set the following configuration in DUT0 :

set system login role cfg level 10
set system login user admin authentication encrypted-password '$6$izy9EZ5puwAJa4hq$eHdBXd/dR.QMsazAJvaMzXrSB2gs2gDtY/6kl73ZAV7G7XIH9EgBbyNDGgaxtBtZrKonrAWAYFagLEyxWw.ih.'
set system login user test authentication encrypted-password '$6$BgPs3HUZt6p4IBvr$cq9NIep9kfjipuOqpxHZ/xX/ujGY7fIIpCqfVy0oHPql5MrOtg9LFlMNcf.NC0nak5nhHr5l7bRr0RioCtq2r/'
set system login user test role cfg
set system security medium

Step 2: Login as test with password tEst!2qqqqqq

Step 3: Run command file show running://log/user/audit_file/audit_file at DUT0 and check if output contains the following tokens:

Permission denied
Show output
hexdump: /opt/vyatta/etc/config/log/user/audit_file/audit_file: Permission denied
hexdump: all input file arguments failed